Windows iSCSI Target CVE-2026-65791

Exploitation requires that the target host has the Windows iSCSI Target Server role installed and running with its listener (default TCP 3260) reachable from the attacker's network position - this role is not installed by default on Windows Server, so a host without it configured is not exploitable. Given the CVSS vector AV:N/AC:L/PR:N/UI:N, once the service is exposed there are no authentication, privilege, or user-interaction prerequisites: any attacker who can reach the iSCSI target port can attempt exploitation against a default-configured (post-install) service. The primary limiting factor is therefore the presence and network exposure of the iSCSI Target role rather than any additional attacker precondition.

All available signals point to top-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with full compromise of confidentiality, integrity, and availability, yielding a 9.8 base score. The mitigating factors are deployment scope rather than exploit difficulty - the iSCSI Target role is not enabled by default on Windows Server and must be installed and exposed for the attack surface to exist. No EPSS score, SSVC decision, or KEV entry was provided in the input, so exploitation-probability and automatability signals are unknown and cannot be weighed; treat their absence as missing data, not as evidence of low risk. There is no indication of a public POC. Net assessment: a genuinely dangerous pre-auth RCE that warrants urgent patching wherever the role is deployed, though real-world blast radius is bounded by how commonly the iSCSI Target Service is exposed.

An attacker with network reachability to a Windows Server exposing the iSCSI Target Service (TCP 3260) sends a crafted iSCSI PDU whose length or field values overflow a heap buffer in the target's request parser. The corruption is shaped to overwrite heap-managed pointers, redirecting execution to attacker-supplied code that runs in the service context without any credentials or user interaction. No public POC is known at the time of analysis, so exploitation would require the attacker to develop a reliable heap-grooming exploit.